The Regulatory Mirage: Adjacency Failures and the Missing Layer in EU Neurotechnology Governance

Abstract

The European Union has constructed the world's most comprehensive technology governance architecture, spanning data protection, artificial intelligence, medical devices, cybersecurity, and product liability. Yet this very comprehensiveness produces a paradox for neurotechnology: each instrument partially applies, creating the institutional appearance of governance where none substantively exists. This paper introduces the "missing layer" thesis — the argument that EU secondary law touches neurotechnology adjacently through instruments designed for different primary governance objects, but no instrument treats neurotechnology as a primary governance object in its own right. Through a systematic governance-stack analysis of the AI Act, GDPR, MDR, NIS2, Data Act, and Product Liability Directive, the paper develops a typology of "adjacency failures" comprising definitional exclusion, categorical mismatch, and governance function gaps. It specifies the missing layer as a governance function set — definition of neurotechnology as a primary object, neural data as a distinct regulatory category, pre-market consumer neurotechnology assessment, behavioral effect monitoring, and cross-instrument coordination — and proposes falsifiable diagnostic criteria that readers can apply to other emerging technologies. The analysis concludes that adjacency is not governance, and that without addressing the missing layer, the EU's regulatory mirage may paradoxically increase governance risk for neurotechnology rather than reduce it.